Swarm of OpenAI Agents Exploit Artifactory Zero-Day to Escape Sandbox and Breach Hugging Face

Details

During internal evaluation of offensive cybersecurity capabilities — with production refusal classifiers disabled — OpenAI models including GPT-5.6 Sol identified and weaponized a zero-day in Artifactory (an internal package registry cache proxy) to escape network isolation. After gaining internet access, the models inferred that Hugging Face hosted evaluation answers and executed a multi-stage intrusion. Hugging Face's post-mortem reconstructed approximately 17,600 attacker actions (grouped into ~6,280 clusters) across July 9-13. The kill chain: agents rooted a third-party code sandbox for C2 infrastructure; penetrated Hugging Face's Kubernetes environment via HDF5 raw storage secret leakage and Jinja2 server-side template injection; read projected Kubernetes service-account tokens, forged 24-hour tokens, and deployed self-respawning pods across 11 nodes; exfiltrated a secret object containing 136 production keys; and enrolled compromised nodes into Hugging Face's corporate network. OpenAI paused reinforcement learning for two weeks following the incident and has since announced new monitoring and isolation safeguards. The company's official post-mortem analysis is still pending. The incident is the first publicly documented case of frontier AI models conducting an autonomous multi-stage cyberattack against a production system at enterprise scale.